December 2003 - cypherpunks-legacy

Re: GAK solutions was: Is there a lawyer in the house?
by Carl Ellison 17 Dec '03

17 Dec '03

>>This is not far from the idea that CME proposed that the NSA/FBI/CIA >>publish public keys, and we'll hack a voluntary version of PGP that >>encrypts the session key with the LEA public key -- instant >>voluntary Key Escrow. > >I still think that's the only way the gov't will get GAK -- :) Actually, the real proposal (http://www.clark.net/pub/cme/html/no-ke.html) is to have them give me their public keys. I would sign and post them. The world's citizens would then add them to their public keyrings and, when they feel like volunteering GAK, would include these agencies as crypto-recipients -- on a per-message basis. No meetings -- no hassle -- nearly 0 cost -- and the gov't could have GAK tomorrow. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +---------------------------------------------- Jean Ellison (aka Mother) -+

1 0

Re: PGP
by Adam Hupp 17 Dec '03

17 Dec '03

Sorry...I was always taught that the user should not be mandated to finish the job of the programmer. Please, do not take me wrong, PGP is a remarkable tool...but I was not aware I had iron out the bugs. That part is the easiest to do compared with the genius of the program... but I still should not have to do it. This is not "ironing out bugs". It is configuring the program to run on your version of Unix. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQBtAzCNppQAAAEDALhWZl7IuGZ9zZT5bACo0b/1L0Nv0C72vKHIO3IHh+cwpHHa 2Ozb9aeO0UvXGwkkZIYgUm0EvmzKh7yb1GTLvBp5kXpR3I9w+Yj4LGlBDERpUWw6 x4ED49pwDnz1Hl5FBQAFEbQYYXNoIDxhaHVwcEBwcmltZW5ldC5jb20+ =PtJK -----END PGP PUBLIC KEY BLOCK-----

1 0

Oh Yeah? ipsecure
by Ecafe Mixmaster Remailer 17 Dec '03

17 Dec '03

For Immediate Release Contact: National Semiconductor Lori Sinton (408) 721-2448 lori(a)ipower.nsc.com http://www.ipsecure.com CryptoSampler, from National Semiconductor, Demonstrates Ease of Building Secure Electronic Commerce and Communications Applications Company's iPower(tm) Business Unit Launches Free CryptoSolver to Inaugurate New Web Site SANTA CLARA, Calif., November 27, 1995 --- National Semiconductor Corporation today announced the availability of its CryptoSampler package for applications developers interested in gaining a "hands on" understanding of how cryptography solves modern business problems. Developed by National's iPower Business Unit, the program consists of three demonstration applications and the PersonaCard(tm) 100, a hardware token for personal, portable data security. The package contains both the demonstration applications including "build-it- yourself" tools to integrate security easily into electronic commerce and communications applications. Priced at $129, the CryptoSampler package is available to the first 1,000 U. S. respondents and can be ordered directly from National's iPower Business Unit. In a related move, the company's iPower Business Unit launched its own web site along with CryptoSolver, an interactive game that invites participants to solve encrypted messages based on the concepts of substitution ciphers and the alphabetic frequency table. CryptoSolver, a technology-teaser game rates players' deciphering skills and can be downloaded from iPower's new web site free. "As networks become the lifeblood of corporations and the principal means of commerce, securing electronic transactions and proprietary information over public and private networks is absolutely critical," said Tom Rowley, marketing director for National's iPower Business Unit. "Through this program, we hope to help broaden individual's understanding of how modern security technology can solve real problems on the Internet and in Electronic Commerce business applications," Rowley explained. CryptoSampler Package - Token Plus Three Applications in One ------------------------------------------------------------ The CryptoSampler package consists of a PersonaCard 100 data security token, a floppy disk containing all three demonstration applications, a cryptography primer written by recognized cryptography expert Bruce Schneier, and a questionnaire. Customers who choose to complete and return the questionnaire, will receive a free copy, while supplies last, of Bruce Schneier's newly-released book, Applied Cryptography, second edition. o PersonaScreen(tm) System Lockout Utility is a screen locker that prevents unauthorized entry into a personal computer by locking the keyboard and mouse. The PersonaCard Token, implemented in the PC Card (formerly PCMCIA) Type II format, locks and unlocks the desktop computer. o PersonaSecure(tm) Word Utility enables users to sign, seal (encrypt, decrypt), and verify documents as well as e-mail messages from within Microsoft Word 6.0 for Windows. Installed automatically, PersonaSecure displays a toolbar that corresponds to the functions of National's PersonaCard data security token. The hardware token incorporates RSA's industry-standard digital signature and encryption formats which are now "token aware." In addition to protecting and validating Microsoft Word documents, users can encrypt and decrypt e-mail messages with others who have installed the PersonaSecure Word Utility. o PersonaDLL Library for Visual BASIC 3.0 is a Dynamic Link Library (DLL) of routines that enables developers to quickly and easily develop their own applications incorporating high-level data security features. PersonaDLL includes a Visual BASIC application, Visual BASIC source code, and access to all of the features of the PersonaCard 100 token including digital signatures, RSA key generation, encryption, and verification. System requirements to run the CryptoSampler package are: Microsoft Windows 3.X, Windows for Workgroups 3.X, and a PC Card slot (version 2.1 or later). Microsoft Word 6.0 is required for the PersonaSecure Word Utility. Pricing and Availability ------------------------ The CryptoSampler package is available with or without a PC Card Reader. For those who plan to run CryptoSampler applications on a desktop or portable personal computer already equipped with a PC Card slot, the basic package is offered at a special price of $129 (including handling and shipping). A CryptoSampler package with PC Card reader is available for $199. The total retail value of the basic package and configuration with card reader is $300 and $500, respectively. To order the CryptoSampler package in either configuration, call 1-800-272-9959 Ext# 631 between the hours of 7 AM and 7 PM Central Standard Time. To play CryptoSolver and for more information about the CryptoSampler program, see the iPower web site at http://www.ipsecure.com . iPower Security Solutions ------------------------- Introduced a year ago, iPower technology provides the highest-level of commercially available security in a personal, portable hardware token. iPower solutions are already being incorporated by OEMs, ISVs, and VARs into a variety of applications and hardware platforms including e-mail and messaging, electronic commerce, network security, and secure access to on-line services including the Internet. National Semiconductor Corporation provides technologies for moving and shaping information. The company focuses on four key areas - communications, consumer, industrial, and personal systems. National Semiconductor is headquartered in Santa Clara, California, and has 22,300 employees worldwide. -30- Note to Editors: To receive a CryptoSampler package for review, call or e-mail Lori Sinton, 408 721-2448 or sampler(a)ipower.nsc.com iPower and PersonaCard are trademarks of National Semiconductor Corporation. All other trademarks are held by their respective companies.

1 0

Re: [NOISE] Re: FW: websurfer 4.6
by Ed Carp 17 Dec '03

17 Dec '03

> Date: Thu, 7 Dec 1995 15:49:09 -0600 (CST) > From: Aleph One <aleph1(a)dfw.net> > To: Rich Graves <llurch(a)networking.stanford.edu> > Cc: cypherpunks(a)toad.com > Subject: Re: [NOISE] Re: FW: websurfer 4.6 > On Thu, 7 Dec 1995, Rich Graves wrote: > > [snip] > > Microsoft's strategy is to support VB. > [snip] > > -rich > > > > Its interesting to note that all the people that were raving mad about Java > seem to be quiet now that MS is proposing to use VB. At least Java was > designed from the ground up with security in mind. But VB? Actual binary Well, at least it's easy and fun to program in (if you can call drag-'n-drop "coding"). Of course, until 4.0, their setup utility didn't check what version of DLL you were installing, so it's easy to get your DLLs out of sync on your system and blow your applications all to hell, and 4.0 throws all thos OLE crap in, even if you don't need/want/use OLE in your code and makes a 300K application into a 3M one, and they won't tell you what really goes on underneath the hood (I guess they're paranoid about getting ripped off), and never mind that it's almost trivial to write a VB decompiler (the .EXE is just a big jump table into offsets into VBRUN300.DLL), etc., etc., etc... And all this from a software company that took over 10 years to make their "operating system" do preemptive *anything*. But I guess I shouldn't complain. After all, VB has made me a pretty decent living for the past year or so...

1 0

the X.9 Electronic Payments ANSI standard
by sameer 17 Dec '03

17 Dec '03

My inquiries regarding Rich's post of the X.9 informal notes were rather fruitful. The chair of the working group seems interesting in including anonymous token-based payment systems in the standard, "I see no reason, other than interest, for the group to avoid non-account-based payment systems, to complement the account-based payment systems that we are now in the process of standardizing." Someone from Citicorp pointed me to http://www.llnl.gov/fstc and asked for my feedback. These people do seem interested in anonymous systems, they just don't have anyone who knows the stuff to work on it. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org/ (or login as "guest") sameer(a)c2.org

2 1

Re: FW: websurfer 4.6
by Ed Carp 17 Dec '03

17 Dec '03

> Date: Thu, 7 Dec 1995 15:12:07 -0500 > Subject: Re: FW: websurfer 4.6 > To: cypherpunks(a)toad.com > From: Rich Graves <llurch(a)networking.stanford.edu> > -----BEGIN PGP SIGNED MESSAGE----- > > On Thu, 7 Dec 1995, Anonymous wrote: > > > Not surprising. They confuse random doodling with software, too. > > > > The real problem with NetManage is a severe case of brain death. > > My, thanks for your opinion. > > It may interest you to know that Microsoft recently licensed a bunch of > stuff from NetManage (San Jose Merc, no real details given). Yeah, and they also think that Windoze is a real opearting system, too...

1 0

Re: Micro$oft and Java
by leefi＠microsoft.com 17 Dec '03

17 Dec '03

| The interesting thing here is a plan to use digital signatures on | controls and scripts as a means of authentication. There was a press release on this. The PR index on http://www.microsoft.com/corpinfo/pr.htm points to a few Internet-related announcements that were made on 12/7. A brief quote on these signatures: "Microsoft plans to propose the Internet digital signature specifications to the W3C and the IETF as an open Internet standard. The technology will be an open, proposed specification available to the entire Internet community. In addition, as part of the Open Process Design Review, Microsoft will host a digital signature design preview in January to solicit feedback from the Internet community." This week there was also another workshop for ~150 ISVs, and these signatures were one of the topics. The event was not under any NDA, so you should start seeing feedback once folks get home and they catch up with mail (at least two were on Cypherpunks). The folks putting on the event have put lots of docs on the "Sweeper" SDK, on the below-referenced web site. Honestly, I'm not sure if all the stuff from the event this week is up there; if not now, most of it will get added in the next week or so. | Servers and some clients will support end-to-end encryption. No details... I believe SSL in current versions of the web browser and server, PCT around the corner (perhaps PCT is earlier than I'm thinking). | Maybe I'll test the search capabilities of the MS Web site later tonight. The clearinghouse for internet developer info (opened 12/7): http://www.microsoft.com/intdev/ It contains info on various VB Script, OLE Control, etc, as they refer to some of our Internet solutions. A page related to this press briefing (I presume also opened 12/7): http://www.microsoft.com/internet/ Hope this helps, Lee Fisher (wondering if I really should've de-lurked)

1 0

Re: Solution for US/Foreign Software?
by Oliver Huf 17 Dec '03

17 Dec '03

> or rational here.) The issue is that, unless written very carefully, > the crypto-less software is a "component of a cryptosystem", > and therefore still requires permission to export. Thanks for the hint. Oli.

1 0

Secrets (was:Is there a lawyer in the house?)
by Adam philipp 17 Dec '03

17 Dec '03

There seems to be some confusion about what the law of the land considers a "secret." Secrets according to our laws are knowledge one doesn not share without a BINDING legal obligation to keep the secret. Remember R4.C? That was a secret until it was shared, and hence lost its privileged position as a "Trade secret." Your secret key is just as safe, so long as it is always kept out of anyone else's hands. However if you are going to provide it to someone else it should be only through some form of contract. Even this might not be sufficient in some circumstances. The only truly safe possibility would be giving it to your lawyer in the course of your lawyers representation of you. NOTE: NOT YOUR COMPANY'S LAWYER. In house council have their obligation to the company, not to you. As such if they felt your key was unrelated to company business interests and possibly adverse to the company's interest...kiss that secret good bye. Sure, the police still need a warrant to go into your house and get the key, but they do NOT need a warrant to ask anyone else for your key, if you revealed your secret to someone who does not have an obligation of confidentiality to you, then they can reveal it with impunity. The danger of revealing it to a nonlawyer who has a contract with you is that they can be forced to reveal it, and still be liable to you for breech of contract... I am sure you see the dangers...just say no to key escrow...much safer. -Adam [NOTE: I am not an attorney, this is not legal advice, you get what you pay for] --=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\ |PGP key available on my home page|Unauthorized interception violates | | http://XXXXXXXXXXXXXXXXX/adam |federal law (18 USC Section 2700 et| |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-|seq.). In any case, PGP encrypted | |SUB ROSA... |communications are preferred for | | (see home page for definition) |sensitive materials. | \-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-/

1 0

Re: Cyberia-L Archive [was Re: ERA_sur]
by The user formerly known as Leslie Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <Pine.ULT.3.91.951206142028.4575V-100000(a)Networking.Stanford.EDU> you write: >As somebody pointed out to me, Cyberia-L, like cypherpunks, is archived >on http://www.hks.net/ and the public news server nntp.hks.net. !!! As far as I know, Cyberia-L isn't accessable via http from us. Please let me know if it is...if so something's very misconfigured. The nntp part is correct, though. And a bunch of the lists might soon be added to the http archives: cypherpunks is the test message base for it. >Now send them some of the money you're going to make from the stock market. That'd be way nice... Small unmarked bills are preferred. - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMMgBryoZzwIn1bdtAQGB3gGA15WO7RLcosT3hrjEJN9d0H6Fk0fMu4lG E/cw+h9YZcB6Nk0jiURfceCkBSz4+JSC =TnoU -----END PGP SIGNATURE-----

1 0